Application Developer

Privilegiada

Management PlaneEntraOps · EAMApplication

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

cf1c38e5-3621-4004-a7cb-879624dced7c

Categoria

Application

EAM Tier

Management Plane (Tier 1)

Enterprise Access Model: Management Plane

Funcoes de gestao de TI enterprise-wide. Alto impacto, mas sem controle total do tenant.

Esta role é classificada como Management Plane porque 1 de 3 ações (33%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

1 Management Plane2 User Access

Ação responsável:

microsoft.directory/oAuth2PermissionGrants/createAsOwner

Descrição

Can create application registrations independent of the 'Users can register applications' setting.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "cf1c38e5-3621-4004-a7cb-879624dced7c",
  "displayName": "Application Developer",
  "description": "Can create application registrations independent of the 'Users can register applications' setting.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/oAuth2PermissionGrants/createAsOwner",

Permissões completas

Todas as 3 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/oAuth2PermissionGrants/createAsOwner`	Application and Workload Identity	Tier 1
`microsoft.directory/applications/createAsOwner`	Extended member	Tier 2
`microsoft.directory/servicePrincipals/createAsOwner`	Extended member	Tier 2

3 de 3 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "cf1c38e5-3621-4004-a7cb-879624dced7c"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/cf1c38e5-3621-4004-a7cb-879624dced7c

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Application Administrator

Tier 0Application

Attack Payload Author

Tier 1Security

Attack Simulation Administrator

Tier 1Security

Attribute Log Reader

Tier 1Compliance

Azure DevOps Administrator

Tier 1Microsoft 365